chore(desktop-client): gate dev-only debug paths in packaged builds

Wrap the network observer, renderer-devtools proxy (both the main-side
ipc handler registration and the preload-side response listener), and
the auto-open-devtools triggers behind !app.isPackaged so packaged
builds don't ship debugging side channels. Add a tiny console-guard
imported first in renderer/main.ts that no-ops console.* in
import.meta.env.PROD so a packaged build stays quiet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/network-observer.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 
+import { app } from "electron/main";
 import type { Session, WebContents } from "electron/main";
 
 import type {
@@ -39,11 +40,16 @@ const requestFilter = {
   urls: ["http://*/*", "https://*/*", "ws://*/*", "wss://*/*"],
 };
 const redactedQueryKeys = /token|signature|sig|auth|key|password|session/i;
+const networkObserverEnabled = !app.isPackaged;
 
 let rendererTarget: WebContents | null = null;
 let originalFetch: typeof globalThis.fetch | null = null;
 
 export function installObservedGlobalFetch(): void {
+  if (!networkObserverEnabled) {
+    return;
+  }
+
   if (originalFetch || typeof globalThis.fetch !== "function") {
     return;
   }
@@ -79,6 +85,10 @@ export function installObservedGlobalFetch(): void {
 }
 
 export function registerObservedRequestRendererTarget(webContents: WebContents): void {
+  if (!networkObserverEnabled) {
+    return;
+  }
+
   rendererTarget = webContents;
   webContents.once("destroyed", () => {
     if (rendererTarget === webContents) {
@@ -91,6 +101,10 @@ export function observeSessionRequests(
   target: Session,
   options: { label: string; partition?: string | null },
 ): void {
+  if (!networkObserverEnabled) {
+    return;
+  }
+
   if (observedSessions.has(target)) {
     return;
   }
@@ -175,6 +189,10 @@ export function observeSessionRequests(
 }
 
 export function startObservedRequest(options: StartObservedRequestOptions): string {
+  if (!networkObserverEnabled) {
+    return "";
+  }
+
   const id = `main:${randomUUID()}`;
   const active: ActiveObservedRequest = {
     id,
@@ -239,6 +257,14 @@ export function failObservedRequest(id: string, error: unknown): void {
 }
 
 export function getObservedRequestSnapshot(): DesktopObservedRequestSnapshot {
+  if (!networkObserverEnabled) {
+    return {
+      rendererAttached: false,
+      activeCount: 0,
+      recent: [],
+    };
+  }
+
   return {
     rendererAttached: Boolean(rendererTarget && !rendererTarget.isDestroyed()),
     activeCount: activeRequests.size,